CVE-2021-0368

CVE-2021-0368 concerns an out-of-bounds read in oggpack_look within bitwise.c, leading to potential information disclosure. The issue is documented for Android 11; the Pixel/Android bulletin indicates this vulnerability is addressed in updated AOSP versions (minimum patch level 2021-03-05, i.e., ...

CVE-2021-0377

CVE-2021-0377 affects Android 11 (DeltaPerformer::Write in delta_performer.cc). Improper input validation allows a local elevation of privilege bypassing defense-in-depth protections with no user interaction. Exploitation details are not provided in the documents. The Pixel/Android bulletin indic...

CVE-2021-0453

CVE-2021-0453 corresponds to a vulnerability in the Titan-M firmware (and related Android kernel component) where uninitialized data can cause a disclosure of stack memory, leading to local information disclosure with system-level privileges required. The public descriptions consistently state th...

CVE-2021-0493

CVE-2021-0493 is an Android memory management driver vulnerability described as an out-of-bounds write caused by a missing bounds check. The affected component is the memory management driver in Android, with potential local escalation of privilege and no additional execution privileges needed. T...

CVE-2021-0525

CVE-2021-0525 affects the Android memory management driver. The underlying issue is a use-after-free that enables an out-of-bounds write, leading to local escalation of privilege with no additional execution privileges required and no user interaction. Exploitation status is not detailed in the p...

CVE-2021-25393

CVE-2021-25393 affects Samsung's SecSettings prior to SMR May-2021 Release 1. The issue is improper sanitization of an incoming intent that lets a local attacker gain permissions to access system UID data. Affected component is the Settings app on Samsung Android devices; root cause relates to in...

CVE-2021-25459

CVE-2021-25459 affects BlockchainTZService. The vulnerability is an improper access control in the sspInit() function that allows attackers to start the BlockchainTZService. Affected versions are prior to SMR Sep-2021 Release 1. Exploitation details are not provided beyond local access vectors im...

CVE-2022-20013

The CVE-2022-20013 entry concerns the vow driver with a race-condition that enables memory corruption and local escalation to System privileges. Affected component: vow driver (MediaTek context appears in related sources). Impact: local privilege escalation with high impact on confidentiality, in...

CVE-2022-20018

CVE-2022-20018 concerns the seninf driver, with a reported information-disclosure issue caused by uninitialized data. This could lead to local information disclosure with SYSTEM privileges required; user interaction is not needed. The fix is patch ALPS05863018 (Issue ID: ALPS05863018). Exploitati...

CVE-2022-20023

Technical details about CVE-2022-20023 are not publicly disclosed in the provided documents. Monitor for updates from vendors and security advisories for affected Bluetooth implementations; current sources reiterate a denial-of-service risk without exploitation specifics.

CVE-2022-20214

CVE-2022-20214 (Android) affects the Car Settings app on Android 10–12. The vulnerability is a tapjacking issue where an attacker can overlay the “Modify system settings” toggle, potentially allowing apps to modify system settings without user consent. The CVSS 3.1 base metrics indicate: Attack V...

CVE-2022-20215

CVE-2022-20215 describes a tapjacking/overlay attack in the MasterClearConfirmFragment.java on Android 10–12 that could trigger a local factory reset, causing a denial of service without extra privileges. Exploitation requires user interaction and can occur locally; no exploit details or likeliho...

CVE-2022-20321

CVE-2022-20321 affects Android 13 where the Settings component fails a permission check, allowing an application without permissions to read the contents of WiFi QR codes. The underlying issue is a missing access control in the UI flow for reading WiFi network data, enabling local information dis...

CVE-2022-26457

CVE-2022-26457 affects MediaTek vow, with an out-of-bounds write caused by a missing bounds check that could enable local privilege escalation to SYSTEM. Exploitation requires local access; no user interaction is needed. Patch ALPS07138490 (Issue ALPS07138490) is noted as the remediation in the p...

CVE-2022-39128

CVE-2022-39128 corresponds to a vulnerability in the sensor driver that can cause a local denial of service in the kernel due to an out-of-bounds write from a missing bounds check. The connected documents consistently describe: (1) the flaw as a bounds-check omission in the sensor driver, (2) imp...

CVE-2022-39894

CVE-2022-39894 affects Samsung Phone’s ContactListStartActivityHelper. The issue is an improper access control that can expose sensitive information via an implicit intent in versions prior to the SMR Dec-2022 Release 1. Public sources (NVD/Red Hat/CNNVD/PT-Security) describe the vulnerability as...

CVE-2022-39896

CVE-2022-39896 affects Samsung Contacts prior to SMR Dec-2022 Release 1. The issue is improper access control that could allow access to sensitive information via implicit intents. Affected component: Contacts; root cause identified as access-control weakness. Impact described in sources as expos...

CVE-2022-42540

CVE-2022-42540 is described as an Elevation of Privilege affecting Chromecast’s AMLogic Secure Monitor. The Chromecast Security Bulletin lists CVE-2022-42540 among issues addressed by the 2023-07-01 patch level, indicating a vendor-provided fix in Chromecast firmware. NVD assigns a 3.1 base score...

CVE-2022-42761

CVE-2022-42761 concerns the WLAN driver in UNISOC chipsets, where a missing bounds check can enable local denial of service in WLAN services. The NVD/Red Hat/UNISOC‑linked entries describe the issue and assign CVSS v3.1 base score 5.5 (Medium) with LOCAL attack vector, LOW complexity and privileg...

CVE-2022-42768

CVE-2022-42768 affects the WLAN driver (notably in Unisoc chipset contexts) and is caused by a possible missing bounds check in the WLAN driver, leading to local denial of service in WLAN services. The Red Hat, NVD, CVE listings and related feeds corroborate the same description, with no explicit...

CVE-2022-44419

CVE-2022-44419 affects the modem’s NAS security mode handling, where missing verification of NAS Security Mode Command Replay Attacks in LTE allows a local attacker to cause denial of service without extra privileges. The issue is described across multiple sources as a local impact with a high av...

CVE-2022-44424

CVE-2022-44424: The issue is a missing permission check in the music service that can trigger a local denial-of-service in the contacts service without requiring additional privileges. The available sources do not provide concrete exploit details, affected product versions, or a documented fix. M...

CVE-2022-47484

CVE-2022-47484 concerns a missing permission check in the telephony service, enabling local denial of service without additional execution privileges. Connected sources consistently reference the telephony module and privilege check omission as the root cause, but do not provide concrete details ...

CVE-2022-47493

The CVE-2022-47493 entry describes a missing permission check in the UNISOC Soter service, enabling local denial of service with no additional execution privileges. The issue is tied to the soter service component and is described as a local vulnerability with a high availability impact, but no e...

CVE-2022-48373

The CVE-2022-48373 entry concerns a local out-of-bounds write in the UNISOC/tee service due to a missing bounds check, leading to local denial of service with SYSTEM privileges. Public references (NVD, Red Hat, CVE list, vuln enrichment) confirm the same root cause and impact, but exploitation st...

CVE-2022-48374

CVE-2022-48374 affects the UNISOC tee service. The root cause is a missing bounds check that enables an out-of-bounds write, resulting in local denial of service with System execution privileges required. Affected component is the tee service in UNISOC chipsets; specific vulnerable versions are n...

CVE-2022-48384

CVE-2022-48384 affects the srtd service on UNISOC chipsets. The root cause is a missing permission check that can lead to local escalation of privilege with no extra execution privileges. The CVSSv3.1 base score is 7.8 (LOCAL, LOW privileges required, HIGH impact on confidentiality, integrity, an...

CVE-2022-48453

CVE-2022-48453 affects a camera driver (Unisoc-based devices) with a missing bounds check that can trigger an out-of-bounds write. Impact is local denial of service with system privileges required; CVSSv3.1 vector indicates local access, high privileges, and availability impact, with a medium bas...

CVE-2023-20649

The CVE-2023-20649 entry concerns the MediaTek ril module. A missing bounds check can cause an out-of-bounds read, enabling local information disclosure with system execution privileges required. Exploitation does not require user interaction, but the vulnerability is confirmed as LOCAL with HIGH...

CVE-2023-20665

CVE-2023-20665 affects ril with an out-of-bounds read due to a missing bounds check, enabling local information disclosure without user interaction. Exploitation details are not provided in the connected documents; there is no explicit in-the-wild exploit data. The vulnerability is associated wit...

CVE-2023-20711

CVE-2023-20711 affects the keyinstall component and describes a possible out-of-bounds read due to a missing bounds check, enabling local information disclosure with system privileges needed. Exploitation details are not specified in the provided documents; user interaction is not required. The p...

CVE-2023-20749

The CVE-2023-20749 issue affects the swpm module in MediaTek chips, caused by a missing bounds check that enables an out-of-bounds write. This could lead to local escalation to SYSTEM privileges with no user interaction required. A patch is available (ALPS07780926/ALPS07780926). Exploitation stat...

CVE-2023-20775

CVE-2023-20775 describes a local out-of-bounds write in the display code due to a missing bounds check, enabling local privilege escalation with System rights; no user interaction required. Impacted hardware is reported as various MediaTek chips (per connected references), with a patch identified...

CVE-2023-20786

The CVE-2023-20786 entry concerns the MediaTek GPS component. A missing bounds check enables an out-of-bounds write, leading to local escalation of privilege with System execution privileges required. Exploitation does not require user interaction. A patch entry is noted as ALPS07767811 (Issue AL...

CVE-2023-20788

CVE-2023-20788 affects MediaTek devices in the thermal component where a race condition can cause a use-after-free, enabling local privilege escalation to SYSTEM if exploited. Exploitation details are not provided in the documents; no user interaction is required. A patch is referenced (ALPS07648...

CVE-2023-21230

CVE-2023-21230 affects Google Wear OS / Android framework. A precondition check failure in the onAccessPointChanged method of AccessPointPreference.java could allow unprivileged apps to receive broadcasts about WiFi access point changes (including BSSID/SSID), enabling local information disclosur...

CVE-2023-21346

CVE-2023-21346 is listed in Android 14 security release notes under Framework with Type ID and Moderate severity. The initial description indicates a local information-disclosure via Device Idle Controller side-channel (no user interaction required). Connected notes confirm framework-level classi...

CVE-2023-21370

CVE-2023-21370 is an elevation-of-privilege flaw in the Android Security Element API. The root cause is an integer overflow that enables an out-of-bounds write, leading to local privilege escalation with System privileges. Exploitation requires no user interaction. The affected component is the S...

CVE-2023-21383

Technical details (affected product/version/root cause/fix) for CVE-2023-21383 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2023-30921

CVE-2023-30921 affects UNISOC chipsets (SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T770/T820/S8000). Root cause: missing permission check in the messaging service, enabling local information disclosure with no additional execution privileges. Impact per sources: local confidential...

CVE-2023-30938

CVE-2023-30938 involves a missing privilege check in the telephony service that can lead to local information disclosure without extra execution privileges. Connected sources describe affected UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T612, T616, T820, S8000)...

CVE-2023-32807

The CVE-2023-32807 issue affects the wlan service in MediaTek-based devices, caused by an improper input validation that leads to an out-of-bounds read. This could allow local information disclosure and requires system privileges, with no user interaction needed. The vulnerability details are sup...

CVE-2023-32864

CVE-2023-32864 describes an out-of-bounds write in the display drm component of MediaTek chips caused by an incorrect bounds check. This can lead to local escalation of privilege with System-level execution privileges required; no user interaction is needed for exploitation. A patch is identified...

CVE-2023-32878

CVE-2023-32878 affects the battery module in MediaTek chips, where a missing bounds check can cause information disclosure. The vulnerability permits local information disclosure with system execution privileges required, and no user interaction is needed. A patch is identified (ALPS08308070; ALP...

CVE-2023-32889

CVE-2023-32889 affects the Modem IMS Call UA component, where a missing bounds check enables an out-of-bounds write leading to remote denial of service without user interaction. The issue is documented across NVD, Red Hat, PRION, CVE listings, and related advisories, with a patch ID MOLY01161825 ...

CVE-2023-40101

CVE-2023-40101 describes an out-of-bounds read in the collapse path of canonicalize_md.c that can disclose local information without extra privileges or user interaction. Public records in multiple sources (NVD, Red Hat, CNVD, etc.) confirm the same description. The Android 14 release notes list ...

CVE-2023-40643

CVE-2023-40643 affects the Messaging component. The root cause is a missing permission check, which could allow local information disclosure without requiring additional execution privileges. The CVSS details indicate a Local attack vector, Low attack complexity, Privileges required: Low, with Co...

CVE-2023-40650

CVE-2023-40650 affects the Telecom service and is caused by a missing permission check that can allow local information disclosure without requiring additional execution privileges. Public information in connected sources confirms the issue and its impact, but does not provide product/version spe...

CVE-2023-42646

CVE-2023-42646 concerns UNISOC-based systems with an Ifaa service that lacks a required permission check, enabling local information disclosure without additional privileges. The root cause is insufficient access-control in the Ifaa service, leading to exposure of sensitive data to an attacker wi...

CVE-2023-42648

CVE-2023-42648 affects UNISOC chipsets in engineermode, where a missing permission check can lead to local information disclosure without requiring elevated privileges. The available connected documents confirm the root cause (in engineermode) and the potential impact (local information disclosur...